Teams and invitations

Create a team

Sign in to your own SignalShelf account. POST /api/teams with a name to create a team; you become its owner. GET /api/teams lists only teams you belong to. GET /api/teams/{id} returns that team's details and member list to its members.

Use the dashboard's session cookie or a server-side x-api-key when calling these APIs. Team membership does not grant access to another person's API keys, saved creators, request history or credits. Responses declare pooled_billing: false: lookups continue to use the caller's personal balance.

POST /api/teams
Content-Type: application/json

{"name": "Creator research"}

Invite someone with a link

An owner or admin can POST /api/teams/{id}/invitations with an email address and role. The response contains invite_url and email_sent: false. Copy the returned link and share it privately with the intended person through your own channel; SignalShelf does not send invitation email.

The invited person signs in or creates an account using the invitation's email address, then accepts it. API clients POST the token from the link to /api/team-invitations/accept. Acceptance checks the signed-in account's stored email. Account email verification is not enabled, so this check does not prove mailbox ownership.

Links expire after seven days and can be accepted once. Creating a replacement invitation for the same team and email invalidates the previous link. Invitation tokens are stored as hashes; invitation lists do not reveal reusable tokens. Treat the returned link as a secret.

POST /api/teams/TEAM_ID/invitations
Content-Type: application/json

{"email": "colleague@example.com", "role": "member"}

POST /api/team-invitations/accept
Content-Type: application/json

{"token": "TOKEN_FROM_THE_PRIVATE_INVITATION_LINK"}

Choose the right role

The creator is the owner. An owner can invite admins or members, change an existing admin or member's role, and remove either. Owner transfer, owner removal and owner demotion are not supported.

An admin can invite members, view invitations and remove members. An admin cannot invite another admin, change roles or remove the owner or another admin. A member can read team details and leave the team, but cannot invite others or manage their roles.

All members can see the member list, including members' names and account email addresses. Owner and admin invitation lists contain invitation email addresses, roles and status. They do not contain raw tokens.

Change access and leave a team

An owner can PATCH /api/teams/{id}/members/{userId} with role set to admin or member. DELETE on the same path removes an allowed target; a non-owner can target their own membership to leave.

Removing a person or demoting an admin invalidates pending invitations that depended on their former authority. Once removed, the account cannot read that team's details. The person's personal account, keys, credits and saved creators remain their own.

PATCH /api/teams/TEAM_ID/members/USER_ID
Content-Type: application/json

{"role": "member"}

DELETE /api/teams/TEAM_ID/members/USER_ID

Limits and errors

An account can belong to at most ten teams. A team can have fifty members and one hundred pending invitations. Invitation creation is limited to ten per team per minute, in addition to normal API limits.

A team not visible to the caller returns 404. A member trying an action outside their role receives 403. An email mismatch also returns 403. Expired, replaced, already accepted or invalidated invitations return 410; a duplicate team membership returns 409.

These team APIs currently manage membership only. They do not provide pooled billing, shared keys or a shared creator collection. Payment processing and invitation email delivery require separate integrations.